79539309

Date: 2025-03-27 15:23:48
Score: 0.5
Natty:
Report link

There is no upper limit defined for size of JWT token. ​The JSON Web Token (JWT) standard (RFC 7519) does not specify a maximum token size. But this also depends on the usage as to where & how the JWT token is being used.

When used as Http header:
If the token is passed as bearer token in http header, many web servers do not allow this to be more than 8 KB. It's safe to keep it to 7 KB.

When JWT is stored in a cookie:
Browser usually supports cookies up to 4 KB, hence its better to keep that limit.

When storing in database:
We need to make sure the database column size is sufficient enough to house the token.

I have encountered the problem of using a large token & not able to use it to invoke the API either from Postman or from browser (While passing the JWT token in the http header). In that case, we had to find an alternate solution. We generated a pair of JWTs - one the full token and another a smaller version of the same but both containing same JTI value (A UUID unique to identify the token). The full token would contain lot of claims & the smaller one would contain minimal basic details. This full token would be store in Redis cache with JTI being the key. The UI will use the small token to invoke APIs. When the full token is needed on the backend, it would use the JTI received from the small token passed by UI & use the same to get the full token from Redis cache.

But, its suggested to keep the claims minimal to the need so that these kind of size related issues don't occur.

Reasons:
  • Long answer (-1):
  • No code block (0.5):
  • Low reputation (1):
Posted by: Shruthi K S